December 2003 - cypherpunks-legacy

Net Papa: Global Internet Taxes Inevitable
by Robert Hettinga 17 Dec '03

17 Dec '03

The other shoe just stepped on a banana peel... Cheers, Bob Hettinga --- begin forwarded text Date: Tue, 9 Sep 1997 19:57:48 +0200 (MET DST) To: dcsb(a)ai.mit.edu, cypherpunks(a)cyberpass.net Subject: Net Papa: Global Internet Taxes Inevitable From: nobody(a)REPLAY.COM (Anonymous) Organization: Replay and Company UnLimited X-001: Replay may or may not approve of the content of this posting X-002: Report misuse of this automated service to <abuse(a)replay.com> X-URL: http://www.replay.com/remailer/ Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: nobody(a)REPLAY.COM (Anonymous) (09/09/97; 12:00 p.m. EDT) By Douglas Hayward, TechWire GENEVA -- Internet taxes are inevitable, according to the man dubbed the "Father of the Net." The only way to avoid global chaos is to create an international agreement on how to do it, added Vint Cerf at a meeting of the Internet Society here. Cerf co-developed the TCP/IP[LINK] protocol on which all Web and Net transaction depend. ...Taxation of the Internet, also called "bit taxes," must be well planned, Cerf said. "And it must also be thought through on a global scale -- not parochially," he said. In the United States. alone, there are 30,000 taxing authorities that might be interested in taxing transactions on the Internet, said Cerf, adding that right now, there is no way to determine which of those authorities should have jurisdiction over a particular transaction. ..."If something is becoming an infrastructure that is important for people's daily lives, then governments will have the right to be concerned about the public's safety and well-being," Cerf said. "When you build roads, you make rules about how people are to behave on these roads, in order to protect people." TW http://192.215.107.71/wire/news/1997/09/0909tax.html For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

4 3

Re: Please send me SSL problems...
by Erik E. Fair 17 Dec '03

17 Dec '03

> I'd just like to let all cypherpunks know that I'm really interested in >getting any feedback you might have about security problems with Netscape >products. I'm particularly interested in bugs in the our implementation >of SSL, and problems in the protocol that are not addressed in SSL 3.0. > > We have been collecting comments on SSL 3.0, and have started incorporating >that feedback into our spec. Please don't assume that our lack of response >means that we are ignoring your comments. Between Navigator 2.0 and >things like the SSL challenge and the RNG fire drill, we just have not had >the time to get a new rev of the spec out. Hopefully soon... Jeff, the SSL specification has a severe *architectural* problem - it assumes that Internet Protocols are APIs - interface standards, and that you can just slide a "layer" underneath without anyone noticing. Such is not the case - all the Internet Protocols are real protocol standards, in that they specify the syntax, order, and semantics of the actual bits on the wire. The IETF quite explicitly doesn't care about APIs - that's a host software issue, and it doesn't matter what the host software looks like (or even what the machine looks like), so long as it gets the bits on the wire right, according to the protocol spec. This is how the Internet can make very strong guarantees about interoperability. You can't fiddle with a communication protocol without getting agreement from everyone about the change, or extend it in a way that is compatible with the protocol you're modifying, on a per-protocol basis (e.g. adding a TELNET negotiation option to TELNET for encryption, an FTP command to FTP, etc). Otherwise, all you've done is made a private, non-interoperable change to an existing protocol that guarantees interoperability *failures* between systems that implement the existing specification, versus your own version of HTTP, or TELNET, or whatever. In short, the SSL specification, as written, proposes to change all Internet application protocols, globally - "slide in a layer." That's not how it's done, and it's not the right place to do it, even if it appears to work in an enclave of systems. About the SSL protocol, encryption algorithms, or the SQA that went into 'em, I think other people have expounded on those issues eloquently, and so I have nothing to add to that. Erik Fair

4 4

Re: Please send me SSL problems...
by jsw＠neon.netscape.com 17 Dec '03

17 Dec '03

In article <9509210118.ZM154@tofuhut>, jsw(a)netscape.com (Jeff Weinstein) writes: > I don't think that the API that SSLRef export is not particularly interesting. Yikes!! I can't believe I wrote that. What I meant was: I don't think that the API that SSLRef exports is particularly interesting. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

1 0

USACM APPLAUDS CALIFORNIA LEGISLATURE
by ACM US Public Policy Office 17 Dec '03

17 Dec '03

PRESS RELEASE Association for Computing U.S. Public Policy Office September 8, 1997 USACM APPLAUDS CALIFORNIA LEGISLATURE FOR UNANIMOUSLY ENDORSING RELAXED EXPORT CONTROLS ON ENCRYPTION As the Congress prepares to address the issue of computer security and privacy, the California legislature has sent a clear message that relaxing controls on cryptography is a critical first step. On September 5, the California legislature passed a resolution that calls on the California members in Congress to support legislation that would make it easier for US companies to develop and market strong cryptography products. The resolution was sponsored by Representative Vasconcellos (D. San Jose) and passed without opposition. Dr. Barbara Simons, chair of the policy committee for the Association for Computing (USACM), said that the California resolution makes clear that industry and users are united in support of good cryptography. "We believe that Congress should support the Security and Freedom Act, sponsored by Representative Goodlatte. The legislation will help protect security and privacy on the internet. It will be a serious mistake for the administration to oppose the development of this technology," said Dr. Simons. On August 26, USACM Chair Barbara Simons spoke in support of the Vasconcellos resolution before a California Senate committee. Also participating at the Committee hearing were Dr. Whit Diffie from Sun, Kelly Blough from PGP, Jack Wilson of ACL Datacom, Chuck Marson representing the California Internet Industry Alliance (Netscape, Microsoft, AOL, CompuServe and Netcom), and a representative of the Software Publishers Association. Undersecretary of Commerce Reinsch wrote a letter opposing the resolution. The Association for Computing (ACM) is an international non-profit educational and scientific society with 76,000 members worldwide, 60,000 of whom reside in the U.S. USACM, the Association for Computing's U.S. Public Policy Office, serves as the focal point for ACM's interaction with U.S. government organizations, the computing community and the U.S. public in all matters of U.S. public policy related to information technology. The USACM web site is located at http://www.acm.org/usacm/ For more information, please contact USACM Chair Barbara Simons at 408/256-3661 or USACM Associate Director Lauren Gelman at 202/544-4859. /\ /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Association for Computing, + http://www.acm.org/usacm/ Office of U.S. Public Policy * +1 202 544 4859 (tel) 666 Pennsylvania Ave., SE Suite 302 B * +1 202 547 5482 (fax) Washington, DC 20003 USA + gelman(a)acm.org To subscribe to the ACM Washington Update, send e-mail to: listserv(a)acm.org with "subscribe WASHINGTON-UPDATE name" (no quotes) in the body of the message.

1 0

What's with the list? (Ol
by damion.furi＠the-matrix.com 17 Dec '03

17 Dec '03

DM|Anyone else get old c'punks postings remailed to them from August? Yup. Blech. furi(a)the-matrix.com pgp-public-key(a)demon.co.uk C1225CE1 RADical 1 Systems - Multi-Platform Custom Programming, Service, & Support

1 0

Re: netscape's response
by Jeff Weinstein 17 Dec '03

17 Dec '03

NOTE: my first attempt to send this bounced at toad.com On Sep 20, 5:16pm, David_A Wagner wrote: > Subject: Re: netscape's response > In article <9509200139.ZM206@tofuhut> you write: > > On Sep 20, 12:29am, Christian Wettergren wrote: > > > One wild idea that I just got was to have servers and clients exchange > > > random numbers (not seeds of course), in a kind of chaining way. Since > > > most viewers connect to a number of servers, and all servers are > > > connected to by many clients, they would mix "randomness sources" with > > > each other, making it impossible to observe the local environment > > > only. And the random values would of course be encrypted under the > > > session key, making it impossible to "watch the wire". > > > > Wow, this is a great idea!! > > Are you quite sure this is a good idea? > > I'd be very scared of it. In particular, it opens up the chance for > adversaries to feed you specially chosen numbers to pollute your seeds. What I should have said is that its a very interesting idea. Given current perceptions of netscape, I should have made clear that I wouldn't do something like this without getting a lot more discussion and review of possible dangers and how to avoid them. I certainly can't fault anyone for wondering if we would just implement this without thinking it through, given recent events. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Letter sent to SJ Mercury staff on CA SJR-29 ...
by Ernest Hua 17 Dec '03

17 Dec '03

Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.current.s… The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

Credit Card might-as-well-equal SSN
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Tue, 9 Sep 1997 15:18:47 -0400 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef(a)substance.abuse.blackdown.org Subject: Credit Card might-as-well-equal SSN Date: Tue, 09 Sep 1997 15:17:52 -0400 From: glen mccready <glen(a)qnx.com> Resent-From: 0xdeadbeef(a)substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef(a)substance.abuse.blackdown.org> archive/latest/2196 X-Loop: 0xdeadbeef(a)substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request(a)substance.abuse.blackdown.org Forwarded-by: Nev Dull <nev(a)bostic.com> Forwarded-by: Jon Loeliger <jdl(a)jdl.com> PRIVACY Forum Digest Monday, 8 September 1997 Volume 06 : Issue 12 Moderated by Lauren Weinstein (lauren(a)vortex.com) Vortex Technology, Woodland Hills, CA, U.S.A. ===== PRIVACY FORUM ===== ------------------------------------------------------------------- The PRIVACY Forum is supported in part by the ACM (Association for Computing) Committee on Computers and Public Policy, "internetMCI" (a service of the Data Services Division of MCI Telecommunications Corporation), and Cisco Systems, Inc. - - - ------------------------------------------------------------------- Date: Wed, 13 Aug 1997 21:38:55 -0500 From: MSproul <msproul(a)arnet.arn.net> Subject: U-Haul/Credit Cards/Social Security Numbers Today I went to the local U-Haul to rent a small trailer to move a lawn tractor. In the course of filling out the rental agreement I was asked for my drivers license then asked for my social security number which I refused to give. (Texas does not have SSN on the driver's license) The agent then asked for a credit card, which I was planning to use to charge the rental. During the subsequent discussion the agent told me that since the Oklahoma bombing if they don't get a SSN they are required to to get a credit card number as a second form of identification. They can then get the SSN from the credit card issuer. Questions: Is this for real? How wide spread is this? What does U-Haul do with your SSN? How difficult is it for someone (company) to get your SSN when you use your credit card? M. L. Sproul Amarillo, TX [ Under current law, your SSN is part of what's called "credit header" data, and is (no longer) protected under the FCRA (Fair Credit Reporting Act). This means that for all intents and purposes, your SSN is public information. -- MODERATOR ] --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

3 2

FW: Notification: Inbound Mail Failure
by Montgomery, Lynn 17 Dec '03

17 Dec '03

Please remove dpeterson(a)jonescyber.com from your mailing list. He is no longer at this company. -----Original Message----- From: Montgomery, Lynn Sent: Tuesday, September 09, 1997 2:46 PM To: Montgomery, Lynn Subject: Notification: Inbound Mail Failure The following recipients did not receive the attached mail. A NDR was not sent to the originator for the following recipients for one of the following reasons: * The Delivery Status Notification options did not request failure notification, or requested no notification. * The message was of precedence bulk. NDR reasons are listed with each recipient, along with the notification requested for that recipient, or the precedence. <dpeterson(a)jonescyber.com> dpeterson(a)jonescyber.com MSEXCH:IMS:JONES:CORPORATE:CEDAR 0 (000C05A6) Unknown Recipient Precedence: bulk The message that caused this notification was: To: cypherpunks(a)toad.com Subject: Letter sent to SJ Mercury staff on CA SJR-29 ... From: Ernest Hua <hua(a)chromatic.com> Date: Tue, 9 Sep 1997 14:30:38 -0600 Cc: hua(a)chromatic.com Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.curren t.sjr.from0000.sjr0029] The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

RE: Letter sent to SJ Mercury staff on CA SJR-29 ...
by Chris DiBona 17 Dec '03

17 Dec '03

The reason is because... The sjmn is crap. Thier valley coverage is terrible, and when it isn't it's coming off ap or reuters. They commonly commit factual errors and thier business editor is a joke. My friends and I in the valley don't even call it by it's name, it's become known as the "Fry's ad" (for those not in the valley, frys is a large consumer and computer electronics shop. But on steriods. And they advertise like crazy all over the sjmn). Remember SJMN motto: If it's news, it ain't here. Chris -----Original Message----- From: Ernest Hua [SMTP:hua@chromatic.com] Sent: Tuesday, September 09, 1997 1:31 PM To: cypherpunks(a)toad.com Cc: hua(a)chromatic.com Subject: Letter sent to SJ Mercury staff on CA SJR-29 ... Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.cu rrent.sjr.from0000.sjr0029] The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0